临近年底，病毒肆虐，为防暴力破解，把服务器改为证书登录

# 生成4096位RSA密钥对
ssh-keygen -t rsa -b 4096 -f "$env:USERPROFILE\.ssh\id_rsa_server" -C "admin@server"

Enter passphrase (empty for no passphrase): 

ssh-copy-id -i ~/.ssh/id_rsa_server.pub root@服务器IP

Get-Content "$env:USERPROFILE\.ssh\id_rsa_server.pub"

$env:Path += ";$env:SystemRoot\System32\OpenSSH"
ssh root@服务器IP

mkdir -p ~/.ssh
chmod 700 ~/.ssh

echo "您的公钥内容" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

cat ~/.ssh/authorized_keys

# 一次性完成公钥添加
$env:Path += ";$env:SystemRoot\System32\OpenSSH"
$publicKey = Get-Content "$env:USERPROFILE\.ssh\id_rsa_server.pub"
ssh root@服务器IP "mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo '$publicKey' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

ssh -i "$env:USERPROFILE\.ssh\id_rsa_server" root@服务器IP

cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# 禁用密码登录
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config
sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config

# 启用公钥认证
echo 'PubkeyAuthentication yes' >> /etc/ssh/sshd_config

vim /etc/ssh/sshd_config

# 禁用密码登录
PasswordAuthentication no

# 启用公钥认证
PubkeyAuthentication yes

# 确保以下配置（可选，提高安全性）
PermitRootLogin prohibit-password

grep -E '(PasswordAuthentication|PubkeyAuthentication)' /etc/ssh/sshd_config

PasswordAuthentication no
PubkeyAuthentication yes

systemctl restart sshd

systemctl status sshd

● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since ...

ssh -i "$env:USERPROFILE\.ssh\id_rsa_server" root@服务器IP

ssh -o StrictHostKeyChecking=no -o PreferredAuthentications=password root@服务器IP "echo '测试'"

Permission denied (publickey,gssapi-keyex,gssapi-with-mic)

$env:Path += ";$env:SystemRoot\System32\OpenSSH"
ssh -i "C:\Users\YourUsername\.ssh\id_rsa_server" -o StrictHostKeyChecking=no root@服务器IP

Host server-alias
    HostName 服务器IP
    User root
    Port 22
    IdentityFile C:\Users\YourUsername\.ssh\id_rsa_server
    StrictHostKeyChecking no

ssh server-alias

notepad $PROFILE

function Connect-CloudServer {
    $env:Path += ";$env:SystemRoot\System32\OpenSSH"
    ssh -i "C:\Users\YourUsername\.ssh\id_rsa_server" -o StrictHostKeyChecking=no root@服务器IP
}

# 设置别名
Set-Alias ccs Connect-CloudServer

ccs

systemctl status sshd

cat /etc/ssh/sshd_config

cat ~/.ssh/authorized_keys

systemctl restart sshd

# 查看最近的SSH登录记录
journalctl -u sshd -n 50

# 实时监控SSH登录日志
journalctl -u sshd -f

who

netstat -antp | grep sshd | wc -l

Test-Path "C:\Users\YourUsername\.ssh\id_rsa_server"

chmod 600 ~/.ssh/id_rsa_server

cat ~/.ssh/authorized_keys

grep PasswordAuthentication /etc/ssh/sshd_config

PasswordAuthentication no

systemctl restart sshd

cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
systemctl restart sshd

systemctl status sshd

# CentOS/RHEL
firewall-cmd --list-all

# Ubuntu/Debian
ufw status

netstat -tlnp | grep 22

Get-Content "C:\Users\YourUsername\.ssh\id_rsa_server" | Select-Object -First 3

-----BEGIN OPENSSH PRIVATE KEY-----
或
-----BEGIN RSA PRIVATE KEY-----

vim /etc/ssh/sshd_config
# 修改 Port 22 为其他端口，如 Port 2222
systemctl restart sshd

# CentOS/RHEL
yum install fail2ban

# Ubuntu/Debian
apt install fail2ban

# 创建普通用户
adduser username
usermod -aG sudo username

# 修改SSH配置
vim /etc/ssh/sshd_config
# 修改 PermitRootLogin yes 为 PermitRootLogin no
systemctl restart sshd

# 端口转发
ssh -L 本地端口:目标地址:目标端口 用户@服务器

# 文件传输
scp -i 私钥文件 本地文件 用户@服务器:/远程路径

# 远程命令执行
ssh 用户@服务器 "命令"

# SSH隧道
ssh -D 本地端口 用户@服务器